@sema-agent/server 7.124.0 → 7.125.0

package/dist/plugins/write-behind-counter.js

@@ -1,3 +1,4 @@
+import { alignedWindow, retryAfterSecUntil } from "../observability/cost-quota.js";
 const SEP = "\u0000";
 export const DEFAULT_COUNTER_QUERY_TIMEOUT_MS = 30_000;
 export class SqlWriteBehindCounter {
@@ -48,24 +49,30 @@ export class SqlWriteBehindCounter {
         catch {
         }
     }
+    window() {
+        return alignedWindow(this.now(), this.windowMs);
+    }
     bucket() {
-        return Math.floor(this.now() / this.windowMs);
+        return this.window().bucket;
     }
-    rk(key) {
-        return `${key}${SEP}${this.bucket()}`;
+    rk(key, bucket) {
+        return `${key}${SEP}${bucket}`;
     }
-    used(key) {
-        const rk = this.rk(key);
+    usedIn(key, bucket) {
+        const rk = this.rk(key, bucket);
         return (this.fleetTotal.get(rk) ?? 0) + (this.pendingDelta.get(rk) ?? 0);
     }
+    used(key) {
+        return this.usedIn(key, this.bucket());
+    }
     addLocal(key, n) {
         if (n <= 0)
             return;
-        const rk = this.rk(key);
+        const rk = this.rk(key, this.bucket());
         this.pendingDelta.set(rk, (this.pendingDelta.get(rk) ?? 0) + n);
     }
     retryAfterSec() {
-        return Math.ceil(((this.bucket() + 1) * this.windowMs - this.now()) / 1000);
+        return retryAfterSecUntil(this.window());
     }
     async flush() {
         if (this.flushing) {

package/dist/prompts-domain-validate.js

@@ -3,9 +3,10 @@ import { createRequire } from "node:module";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { verifyPromptArtifact } from "@sema-agent/core";
+import { PROMPT_SLOTS } from "@sema-agent/settings-schema";
 import { SHA256_DIGEST_RE } from "./digest-form.js";
 const ID_RE = /^[a-z0-9][a-z0-9/._-]*$/;
-const SLOTS = new Set(["identity", "scenario", "behavior"]);
+const SLOTS = PROMPT_SLOTS;
 function declarationIssue(d, where) {
     if (d === null || typeof d !== "object")
         return `${where}: declaration is not an object`;
@@ -14,7 +15,7 @@ function declarationIssue(d, where) {
         return `${where}: bad id`;
     if (o.id.startsWith("core/"))
         return `${where}: id in the reserved core/ namespace`;
-    if (typeof o.slot !== "string" || !SLOTS.has(o.slot))
+    if (typeof o.slot !== "string" || !SLOTS.includes(o.slot))
         return `${where}: bad slot`;
     if (typeof o.text !== "string" || o.text.length === 0)
         return `${where}: text must be a non-empty string`;

package/dist/rules-consent.d.ts

@@ -479,7 +479,7 @@ export declare function serializeRuleScope(scope: RuleScope): string;
  * 🔴 判别式串的**上限,由铸侧的尺派生**([ref],2026-08-19 合并重扫 confirmed —— 修的是「两个数字
  * 各挑各的」这件事本身,不是把某个数字调大一点)。
  *
- * 病:铸侧 `cardRuleScopeRoot` 对 root 长度零把关(入口尺 = `isValidCwd` 的 {@link MAX_CWD_CHARS}),
+ * 病:铸侧 `cardRuleScopeRoot` 对 root 长度零把关(入口尺 = 契约 `isAbsoluteHostPath` 的上界 `ABSOLUTE_HOST_PATH_MAX`),
  * core 与两个店都不设 root 长度上限 ⇒ 写面全程无阻;而 `DELETE /v1/rules` 的体 schema 此前独立写死
  * `scope: max(1088)`,且 safeParse 排在 `parseRuleScope`/权限判据**之前** ⇒ 超限 root 的规则
  * `GET /v1/rules` **列得出**、按同一串 DELETE **恒 400**。全仓只有一个 `lane.removeRule` 调用点(直删
@@ -491,7 +491,7 @@ export declare function serializeRuleScope(scope: RuleScope): string;
  * 不碰盘 ⇒ **任何宿主上** 1081..4096 字符的注册 cwd 都能铸出这样一条规则。
  *
  * 取值 = `"project:"` 前缀 + 铸侧 root 的入口尺。`path.resolve` 对「已绝对、无 `..` 段」的路径不加长
- * (`isValidCwd` 两条都要求),故 {@link MAX_CWD_CHARS} 是 root 的真上界。**两侧从此同源**:谁改铸侧
+ * (`isAbsoluteHostPath` 两条都要求),故 `ABSOLUTE_HOST_PATH_MAX` 是 root 的真上界。**两侧从此同源**:谁改铸侧
  * 的尺,撤侧自动跟。
  */
 export declare const MAX_RULE_SCOPE_CHARS: number;

package/dist/rules-consent.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { createLogger } from "./observability/logger.js";
-import { MAX_CWD_CHARS } from "./task-cwd.js";
+import { ABSOLUTE_HOST_PATH_MAX } from "@sema-agent/settings-schema";
 import { isDirectWritableRuleBehavior } from "./permission-rule-vocab.js";
 import { CONTROL_AND_BIDI_CHARS, hasBidiControls } from "./text-bidi.js";
 import { confirmRuleApproval, RULE_BEHAVIORS, parseRuleText, ruleReachesProgramRun, ruleToolGrammarOf, precheckEditedRuleText, prepareCardApproval, prepareCcImport, redeemRuleBatch, redeemRuleTicket, addPersistedRule, removePersistedRule, isValidDurableScope, effectiveOrThrow, readRowBehavior, } from "@sema-agent/core";
@@ -51,7 +51,7 @@ export function serializeRuleScope(scope) {
             throw new Error("serializeRuleScope got a session scope — session consent never lands on the durable rules wire (design/382 §4.3 two-member durable face); a session row reaching this serializer is a defect upstream, not a spelling to invent");
     }
 }
-export const MAX_RULE_SCOPE_CHARS = "project:".length + MAX_CWD_CHARS;
+export const MAX_RULE_SCOPE_CHARS = "project:".length + ABSOLUTE_HOST_PATH_MAX;
 export function parseRuleScope(text) {
     if (text === "global")
         return { kind: "global" };

package/dist/run-local.js

@@ -18,11 +18,13 @@ import { applyRuntimeGovernance, autonomyModeFloor, entryPermissionMode } from "
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
-import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
+import { CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
 import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
+import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
+import { buildUnreadConfigFileFields } from "./web-admin-client/read-warnings.js";
 import { composeExecutionLane } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
@@ -330,32 +332,43 @@ export async function runLocal(argv, deps = {}) {
     provisionSemaConfigDir(config, logger);
     installOutboundDispatcher(logger);
     const providerInput = { provider: config.configProvider ?? "local", localDir: root };
+    const configSource = configProviderKind(providerInput);
+    if (configSource === "local")
+        logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     try {
-        await composeExecutionLane(config, { configSource: configProviderKind(providerInput), localRoot: root, logger, drivesFromFile: ["host"] });
+        await composeExecutionLane(config, { configSource, localRoot: root, logger, drivesFromFile: ["host"] });
     }
     catch (err) {
         printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
     const configProvider = createConfigProvider(providerInput);
-    if (configProvider.kind === "local")
-        logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     let effective;
+    let candidatePrompts;
     try {
         const r = await configProvider.fetchEffective(undefined);
         if (r) {
-            for (const de of r.domainErrors ?? [])
-                logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: "domain fell to schema defaults; other domains applied normally" });
-            for (const d of r.droppedEntries ?? [])
-                logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
-            effective = r.effective;
-            applyEffective(config, r.effective, logger, { leg: "boot" });
-            if (effective?.mcp)
-                config.mcpServers = resolveMcpServers(effective.mcp, logger);
-            if (effective?.a2a)
-                config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
-            applyCenterReadFace(config, r.effective, logger, { phase: "boot" });
-            logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version });
+            const verdict = judgeConfigCandidate(r);
+            if (verdict.verdict === "rejected") {
+                for (const de of r.domainErrors ?? [])
+                    logger.warn("config_domain_invalid", { domain: de.domain, error: de.error, note: CONFIG_DOMAIN_INVALID_NOTE });
+                logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, "run-local", { lkgVersion: "(env)", ...(configProvider.kind === "local" ? { dir: root } : {}) }));
+            }
+            else {
+                for (const f of r.unreadFiles ?? [])
+                    logger.warn("config_unread_file", buildUnreadConfigFileFields(f, configProvider.kind === "local" ? root : undefined));
+                for (const d of r.droppedEntries ?? [])
+                    logger.warn("config_entry_dropped", { domain: d.domain, entry: d.entry, reasonCode: d.reasonCode, error: d.error, version: r.effective.version, phase: "boot", note: "this one entry failed its domain schema and was dropped on its own — the rest of the candidate applies (per-entry tolerance); fix the named entry to bring it back" });
+                effective = r.effective;
+                candidatePrompts = verdict.prompts;
+                applyEffective(config, r.effective, logger, { leg: "boot" });
+                if (effective?.mcp)
+                    config.mcpServers = resolveMcpServers(effective.mcp, logger);
+                if (effective?.a2a)
+                    config.a2aPeers = resolveA2aPeers(effective.a2a, logger);
+                applyCenterReadFace(config, r.effective, logger, { phase: "boot" });
+                logger.info("config_loaded", { source: configProvider.kind, version: r.effective.version });
+            }
         }
     }
     catch (err) {
@@ -470,13 +483,8 @@ export async function runLocal(argv, deps = {}) {
     })();
     try {
         await promptSource.restore();
-        const promptsRaw = effective?.prompts;
-        if (promptsRaw !== undefined) {
-            const pv = validatePromptsDomain(promptsRaw);
-            if (pv.ok)
-                await applyCatalogToSource(promptSource, pv.value, undefined, logger, "run-local");
-            else
-                logger.warn("center_prompts_invalid", { phase: "run-local", error: pv.error, note: "malformed prompts face — built-ins serve" });
+        if (candidatePrompts !== undefined) {
+            await applyCatalogToSource(promptSource, candidatePrompts, undefined, logger, "run-local");
         }
         else {
             await applyCatalogToSource(promptSource, undefined, undefined, logger, "run-local");

package/dist/runs.d.ts

@@ -116,6 +116,15 @@ export declare function resumeAtHttpStatus(result: {
  * `resumeAtHttpStatus` 自己(单元测试直接喂码)。
  */
 export declare function syncRefusalHttpStatus(result: Pick<TaskResult, "terminal" | "stats">): number | undefined;
+/**
+ * 一条提交腿把引擎终局落行之后的**唯一**收尾:**零工作的拒不占提交幂等键**。判据就是上面这只 {@link syncRefusalHttpStatus}
+ * (零 turn、零 token 且是 prepare 期的拒码)—— 三条提交腿(同步 / 流式 / durable)同调这一只,不另开判据。
+ * 行留作那次拒绝的记录,只放开键:拒绝邀请的正是重发(同步腿的 4xx / 带 `Retry-After` 的 503;流式 / durable 腿结果里的
+ * `retryAfterMs`),同键重发必须按新请求受理,而不是回放这次拒绝。做过工作的结局(完成 / 失败 / 取消 / park)一律占键。
+ */
+export declare function releaseKeyIfZeroWorkRefusal(runStore: {
+    releaseIdemKey(taskId: string): Promise<void>;
+}, taskId: string, result: Pick<TaskResult, "terminal" | "stats">): Promise<void>;
 /**
  * E18 resume-at — per-turn anchor capture, shared by runInBackground AND the resume-leg driveResume so the (single,
  * tricky) capture rule can't drift between the two stream-drain loops.

package/dist/runs.js

@@ -111,6 +111,10 @@ export function syncRefusalHttpStatus(result) {
         return undefined;
     return resumeAtHttpStatus(result);
 }
+export async function releaseKeyIfZeroWorkRefusal(runStore, taskId, result) {
+    if (syncRefusalHttpStatus(result) !== undefined)
+        await runStore.releaseIdemKey(taskId);
+}
 export class TurnAnchorCapture {
     capture;
     onCaptureFail;
@@ -340,6 +344,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 reached = { kind: "done", result: safe };
                 const plane = outwardPlane(safe.terminal);
                 await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
+                await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
                 recordDone(safe, plane.status);
                 return;
             }
@@ -353,6 +358,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 reached = { kind: "done", result: safe };
                 const plane = outwardPlane(safe.terminal);
                 await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
+                await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
                 recordDone(safe, plane.status);
                 return;
             }
@@ -408,6 +414,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         reached = { kind: "done", result: safe };
                         const plane = outwardPlane(safe.terminal);
                         await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
+                        await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
                         recordDone(safe, failureCodeOf(safe.terminal) === CANCELLED_CODE ? CANCELLED_CODE : plane.status);
                     }
                     continue;
@@ -482,6 +489,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 const plane = outwardPlane(reached.result.terminal);
                 settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
+                await releaseKeyIfZeroWorkRefusal(runStore, taskId, reached.result);
             }
             else if (reached?.kind === "suspended") {
                 await runStore.setSuspended(taskId, reached.result);

package/dist/runtime-governance.d.ts

@@ -24,11 +24,11 @@
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
 import { type PermissionMode, type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
-import { GovernanceConfig } from "@sema-agent/settings-schema";
+import { AUTONOMY_MODES, type GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernanceOverrides } from "./governance-overrides.js";
-/** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
-export declare const AUTONOMY_MODES: ("plan" | "auto" | "ask" | "read-only")[];
+/** 运维 autonomy 四档的**闭集**(契约成员表本尊,照旧从本模块转出)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
+export { AUTONOMY_MODES };
 /** A per-command governance rule (registry `runtime.commandPolicy[]`) —— **型也从契约派生**:
  *  契约给 `command` 加一条 refine / 给 `decision` 加一个判词,本仓的型当场跟上(或在下面的
  *  `RANK` / 穷尽 switch 上编译红),而不是靠人记得把手写联合改一遍。 */

package/dist/runtime-governance.js

@@ -1,12 +1,10 @@
 import { clampPermissionMode, combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, modePolicyOf, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
-import { GovernanceConfig } from "@sema-agent/settings-schema";
+import { AUTONOMY_MODES, COMMAND_DECISIONS } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
 import { heldRuleName } from "./tool-rule-names.js";
-const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
-const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
-export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
+export { AUTONOMY_MODES };
 const COARSE_SHELL_TOOLS = CORE_COARSE_SHELL_TOOLS;
 export const COARSE_SHELL_TOOLS_MIRROR = COARSE_SHELL_TOOLS;
 function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {

package/dist/security.d.ts

@@ -3,7 +3,8 @@ import { type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
-import type { SessionFaceReader } from "./session-incarnation.js";
+import type { SessionFace, SessionFaceReader } from "./session-incarnation.js";
+import type { SessionRowPatch } from "./session-row.js";
 /** One row of the session-list projection (CC /resume picker) — the durable session abstraction's enumeration
  *  output (§0.5). Mirrors {@link RunStore}'s shipped `SessionSummary` shape so the wire response is unchanged. */
 export interface SessionListItem {
@@ -23,8 +24,12 @@ export interface SessionListItem {
      *  是两条身份轴,命名对齐 core `SessionStoreSummary.lastTaskRunId`。wire:additive 键零投影透传
      *  (sessions-list.ts);sema-sdk spec `SessionSummary` 闭集候 SDK 半场开键([ref]/.82 班车)。 */
     lastTaskRunId?: string;
-    /** Auto-generated session title (null = untitled / lister face has no session_meta). */
+    /** The session's title — the user's (`PATCH /v1/sessions/:id`) or, until the user sets one, the auto-titler's
+     *  (null = untitled / lister face has no session_meta). One column, two writers, one order: `session-row.ts`. */
     title: string | null;
+    /** Pinned by the user (`PATCH /v1/sessions/:id`). ALWAYS present — `false` by default (a session's state, not a capability);
+     *  a lister face with no session_meta answers `false` (nothing there can pin it). */
+    pinned: boolean;
 }
 /** A SessionStore that may additionally expose tenant-ownership ops (the TiDB store does) AND the
  *  `SessionRepo` enumeration/lifecycle seam (§0.5: list/fork/delete homed on the session abstraction's own
@@ -115,6 +120,18 @@ export type OwnerAwareSessionStore = SessionStore & {
         limit: number;
         q?: string;
     }) => Promise<SessionListItem[]>;
+    /** ONE session's list row — the SAME projection {@link listSessions} emits for it (same columns, same mapper). `undefined` = not a
+     *  row of the list face (no such session, or a placed / delegation-transcript session, which never lists). Reader: the 2c
+     *  manifest (`title` / `pinned`). */
+    sessionSummaryOf?: (sessionId: string) => Promise<SessionListItem | undefined>;
+    /** The session row's writable bits (`title` / `pinned`) — the ONLY writer of a user-set title or pin (`title: null` clears it back
+     *  to the automatic title; the auto-titler's `setTitleIfNull` fills a NULL title only; the law of the two writers is written in
+     *  `session-row.ts`). **Written on the occupant the caller verified, and only on it**: `face` is the {@link sessionFaceOf} read
+     *  the caller's gate judged; the write and the read-back are both conditioned on that occupant's incarnation (the same law as
+     *  the parked decide leg's two reads, `session-incarnation.ts`). Answers that occupant's list row after the write
+     *  ({@link sessionSummaryOf}'s projection); `undefined` = no list row for that occupant (deleted, re-registered by anyone in the
+     *  meantime, or a placed session) — nothing was written. A failed write throws. */
+    patchSessionMeta?: (sessionId: string, patch: SessionRowPatch, face: SessionFace) => Promise<SessionListItem | undefined>;
     /** E17 — fork a session's whole history to a NEW session owned by `owner`; null if the source is unknown. */
     fork?: (sourceId: string, owner: string | null) => Promise<string | null>;
     /** E18 — the session's current leaf `SessionTreeEntry.id` (a cache-bypassing single read), so the resume-at

package/dist/session-row.d.ts

@@ -0,0 +1,53 @@
+/**
+ * 会话行的**可写位**(`title` / `pinned`)—— `PATCH /v1/sessions/:id` 的体闭集、两键的判据,与 2c 导入同读的那一套(唯一属主)。
+ *
+ * ## 一列一事实,写者次序成文
+ *  · `title` 是一列(SQL `session_meta.title` / local 标题边档),两个写者,一条律:**用户**经会话店唯一写口 `patchSessionMeta`
+ *    **无条件**写 —— 写一个串 = 改名,写 `null` = **清回自动标题**(列回到 NULL);**自动标题器**经 `setTitleIfNull` **只填 NULL**
+ *    (每次提交按列读一次:列是 NULL 才起名,见 `session-titler.ts`)。所以清与填是同一列同一律:用户清掉之后,下一次提交由自动标题器
+ *    照常填;用户写过串的会话,自动标题器永不覆盖(无条件写盖得掉自动标题,NULL 守卫盖不掉用户标题)。没有第二列(不另设 `userTitle` /
+ *    `label`)。清的拼法只有 `null` 一种 —— 空串 `""` 是坏体(`request.body_shape`),不是「清」。
+ *  · `pinned` 是一列布尔,缺省 `false`;列表行**恒在场**(置顶是会话的状态,不是能力)。
+ *
+ * ## 上界 = 列宽
+ * {@link SESSION_TITLE_MAX_CHARS} 是 `title` 列的宽度,两方言 DDL 内插的就是这一个数(`tidb-pool.ts` / `pg-session-storage.ts`),
+ * wire 上界与存储上界是同一个事实。按**字符**计(Unicode 码点 —— 与 MySQL 协议 utf8mb4 / PostgreSQL 的 `VARCHAR(n)` 同一单位),
+ * 不按 UTF-16 位计。自动标题器自己的显示预算(`session-titler.ts` 的 `TITLE_MAX_CHARS`)更短,落在这个上界之内。
+ */
+/** `title` 列的宽度(字符)= 用户标题的上界。两方言 DDL 内插它。 */
+export declare const SESSION_TITLE_MAX_CHARS = 120;
+/** 会话行的可写位(体闭集;两键至少一键)。会话店唯一写口 `patchSessionMeta` 的形参。`title: null` = 清回自动标题(列写 NULL)。 */
+export interface SessionRowPatch {
+    readonly title?: string | null;
+    readonly pinned?: boolean;
+}
+/** 一条已分类的拒:码 + 不回显输入的句子。 */
+export interface SessionRowProblem {
+    readonly code: "request.body_shape" | "request.field_invalid";
+    readonly message: string;
+}
+/**
+ * `title` 一格的**唯一**读者(PATCH 体与 2c 导入同读)。`null` ⇒ 清回自动标题;串 ⇒ 1..{@link SESSION_TITLE_MAX_CHARS} 个字符、首尾无空白、
+ * 不含 C0 控制字符({@link C0_CONTROL}),存原文(不脱敏、不改写);空串 ⇒ `request.body_shape`(清的拼法只有 `null`);其余 ⇒ `request.field_invalid`。
+ */
+export declare function readSessionTitle(v: unknown): {
+    readonly title: string | null;
+} | {
+    readonly problem: SessionRowProblem;
+};
+/** `pinned` 一格的**唯一**读者(PATCH 体与 2c 导入同读)。 */
+export declare function readSessionPinned(v: unknown): {
+    readonly pinned: boolean;
+} | {
+    readonly problem: SessionRowProblem;
+};
+/**
+ * `PATCH /v1/sessions/:id` 体的**唯一**读者。形不对(非对象 / 空 / 表外键)⇒ `request.body_shape`;两键各走自己那一格的读者。
+ * 拒句不回显调用方的键名或值。
+ */
+export declare function readSessionRowPatch(body: unknown): {
+    readonly patch: SessionRowPatch;
+} | {
+    readonly problem: SessionRowProblem;
+};
+//# sourceMappingURL=session-row.d.ts.map

package/dist/session-row.js

@@ -0,0 +1,47 @@
+export const SESSION_TITLE_MAX_CHARS = 120;
+const SESSION_ROW_PATCH_KEYS = { title: true, pinned: true };
+const BODY_SHAPE_MESSAGE = "the body must be a JSON object carrying at least one of `title` and `pinned`, and nothing else";
+const EMPTY_TITLE_MESSAGE = "title must not be the empty string — send `null` to clear it back to the automatic title";
+const C0_CONTROL = /[\u0000-\u001f]/u;
+export function readSessionTitle(v) {
+    if (v === null)
+        return { title: null };
+    if (v === "")
+        return { problem: { code: "request.body_shape", message: EMPTY_TITLE_MESSAGE } };
+    if (typeof v !== "string")
+        return { problem: { code: "request.field_invalid", message: "title must be a string, or null to clear it" } };
+    if (Array.from(v).length > SESSION_TITLE_MAX_CHARS)
+        return { problem: { code: "request.field_invalid", message: `title must be 1 to ${SESSION_TITLE_MAX_CHARS} characters` } };
+    if (v !== v.trim())
+        return { problem: { code: "request.field_invalid", message: "title must not start or end with whitespace" } };
+    if (C0_CONTROL.test(v))
+        return { problem: { code: "request.field_invalid", message: "title must not contain control characters (U+0000 to U+001F)" } };
+    return { title: v };
+}
+export function readSessionPinned(v) {
+    return typeof v === "boolean" ? { pinned: v } : { problem: { code: "request.field_invalid", message: "pinned must be a boolean" } };
+}
+export function readSessionRowPatch(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return { problem: { code: "request.body_shape", message: BODY_SHAPE_MESSAGE } };
+    const keys = Object.keys(body);
+    if (keys.length === 0 || keys.some((k) => !Object.hasOwn(SESSION_ROW_PATCH_KEYS, k))) {
+        return { problem: { code: "request.body_shape", message: BODY_SHAPE_MESSAGE } };
+    }
+    const b = body;
+    let patch = {};
+    if ("title" in b) {
+        const read = readSessionTitle(b.title);
+        if ("problem" in read)
+            return read;
+        patch = { ...patch, title: read.title };
+    }
+    if ("pinned" in b) {
+        const read = readSessionPinned(b.pinned);
+        if ("problem" in read)
+            return read;
+        patch = { ...patch, pinned: read.pinned };
+    }
+    return { patch };
+}
+//# sourceMappingURL=session-row.js.map

package/dist/session-sync.d.ts

@@ -127,6 +127,12 @@ export interface SessionManifest {
         entryId: string;
         owner: string | null;
     }>;
+    /** The session row's writable bits (`src/session-row.ts`), read through the list projection (`sessionSummaryOf`): the title
+     *  (`null` = no title — the PUSH that replays it clears the destination back to automatic, the same law as `PATCH`) and the pin.
+     *  Present iff the session is a row of the list face — every ordinary session; a placed (delegation-transcript) session has no
+     *  writable row bits, so both keys are absent there. */
+    title?: string | null;
+    pinned?: boolean;
 }
 /**
  * P1d-α (PULL streaming, §15) — EXPORT a session's portable state as a {@link SessionManifest} (entries LIFTED OFF

package/dist/session-sync.js

@@ -40,10 +40,14 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
         : [];
     const anchorStore = srcBackend.resumeAnchor();
     const anchors = await anchorStore.listBySession(sessionId);
+    const summaryOf = session.sessionSummaryOf?.bind(session);
+    if (summaryOf === undefined)
+        throw new Error("exportSessionManifest: the session store has no row read face (sessionSummaryOf) — the sessionSync fact should have refused this deployment");
+    const row = await summaryOf(sessionId);
     const getBlobFn = fs.getBlob?.bind(fs);
     const getBlob = getBlobFn ? (hash) => getBlobFn(hash) : async () => undefined;
     return {
-        manifest: { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors },
+        manifest: { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors, ...(row !== undefined ? { title: row.title, pinned: row.pinned } : {}) },
         getBlob,
     };
 }

package/dist/session-titler.d.ts

@@ -1,11 +1,15 @@
 /**
  * Auto-generated session titles.
  *
- * SHAPE: fire-and-forget at FIRST task submit for a session (the objective is known then — no need to wait
- * for the run to finish, and the web Recents gets the title sooner). Write-once (`setTitleIfNull`, store-side
- * `WHERE title IS NULL`) — the USER-facing rename lives BFF-side as a label overlay (user label wins
- * over engine title, two layers never fight). Generation = one cheap-model one-liner via the deployment's
- * hookLlm face (summarize role → MODEL_CHEAP_ID when configured, else the main model; bounded + timed out).
+ * SHAPE: fire-and-forget at a task submit whose session has NO title (the objective is known then — no need to wait
+ * for the run to finish, and the web Recents gets the title sooner). Fills a NULL title only (`setTitleIfNull`,
+ * store-side `WHERE title IS NULL`) — the user writes the SAME column unconditionally (`PATCH /v1/sessions/:id` →
+ * `patchSessionMeta`): a user-set title is never overwritten (the probe below reads "titled" and skips the model
+ * call), and a title the user cleared (`title: null` ⇒ NULL) is filled again at the next submit (law: `session-row.ts`).
+ * "Has it a title?" is read from the column on every submit (one point read) — the process keeps NO "already titled"
+ * memo, because such a memo would be a second answer to that question that a clear turns stale. Generation = one
+ * cheap-model one-liner via the deployment's hookLlm face (summarize role → MODEL_CHEAP_ID when configured, else the
+ * main model; bounded + timed out).
  *
  * FAILURE POSTURE: everything is best-effort — a generation/store failure logs and leaves title null (the
  * list falls back to objectivePreview). An in-process pending set dedupes concurrent submits on the same

package/dist/session-titler.js

@@ -58,6 +58,7 @@ export function createSessionTitler(deps) {
                     }
                 }
                 if (state === "titled") {
+                    seen.delete(sessionId);
                     deps.metrics?.inc("session_title_total", { outcome: "already_titled" });
                     return;
                 }
@@ -75,11 +76,12 @@ export function createSessionTitler(deps) {
                 const landed = await deps.setTitleIfNull(sessionId, title);
                 if (!landed) {
                     const after = await probeOrContinue(sessionId, "none");
-                    if (after.state === "none")
+                    if (after.state !== "untitled")
                         seen.delete(sessionId);
                     deps.metrics?.inc("session_title_total", { outcome: after.unreadable ? "probe_failed" : after.state === "none" ? "row_not_yet" : "already_titled" });
                     return;
                 }
+                seen.delete(sessionId);
                 deps.metrics?.inc("session_title_total", { outcome: "set" });
                 deps.logger?.info?.("session_titled", { sessionId, titleChars: title.length });
             })().catch((e) => {

package/dist/spec-fields.js

@@ -1,6 +1,6 @@
 import { isThinkingLevel } from "@sema-agent/core";
 import { taskWallClockSec } from "./task-workflow.js";
-import { isValidCwd } from "./task-cwd.js";
+import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { allowLayerEntryCountIssue, ruleEntryListShapeOk } from "./rule-entry-list.js";
 export function normalizeSuggestNextPrompts(v) {
     if (v === true)
@@ -88,7 +88,7 @@ const SKILL_FIELD_SHAPES = {
     allowedTools: { required: false, ok: skillToolListOk },
     disallowedTools: { required: false, ok: skillToolListOk },
     files: { required: false, ok: skillFilesOk },
-    baseDir: { required: false, ok: isValidCwd },
+    baseDir: { required: false, ok: isAbsoluteHostPath },
 };
 const skillOk = (s) => {
     if (!plainObject(s))

package/dist/task-cwd.d.ts

@@ -1,23 +1,3 @@
-/** Cap on a cwd path length (defensive — a row/path label bound; a real path is far shorter). */
-export declare const MAX_CWD_CHARS = 4096;
-/** Is this a structurally-valid absolute host path? Rejects: non-strings, relative paths (TOC review #12 — a
- *  relative cwd would resolve against the SERVICE process cwd, not the user's project = silent wrong-dir), empty,
- *  over-long, and NUL-byte injection. NOT an existence check (the env surfaces a missing dir at first tool use).
- *  Defense-in-depth (double-review LOW): `path.isAbsolute` is SYNTACTIC — `/a/../../etc` is "absolute" yet contains
- *  `..` traversal that the host env would `path.resolve` away. Single-user host lane = the caller's own machine (no
- *  cross-tenant escape), but we reject any path with a `..` segment so the honored cwd is the literal path sent.
- *
- *  🔴 **接缝登记(7.74.0 / core 7.17.0 [ref],今日无可达分歧 —— 登记的是「以后会分歧」)**:这条判断回答的是
- *  「引擎眼里这条 cwd 算不算绝对」,而引擎自本版起按**树的家族**判(`isAbsoluteForFamily(pathFamilyOf({root,cwd}), p)`,
- *  家族从 root/cwd 的**拼法**读,**从不**读 `process.platform`)。本函数用的是 Node 的宿主口径,两者:
- *   · **posix 家族逐字同判**(2026-09-12 实测六形 `/etc/passwd` / `a/b` / `\\host\share\x` / `C:\x` /
- *     `//host/share/x` / `/c/x` 六格全同)⇒ 今天(Linux 宿主 + posix 树,本位又只在单用户 `host` 车道上场)
- *     **零分歧**,不改;
- *   · **win 家族分歧在 `/`-开头但没有盘符的那一类**(`/etc/passwd`、`/c/x`):Node 的 win32 口径说「绝对」,
- *     引擎说「rooted 但未完全限定」(要拼上基准的盘/共享根才成一条真路径)。⇒ **哪天 `host` 车道要接 win 树,
- *     先改这里**:把判据换成 core 的 `isAbsoluteForFamily`,并把家族从这条 cwd 自己的拼法取。
- *  钉见 `test/task-cwd.test.ts` 的「[ref] 路径家族接缝」格(实测读数,不是推断)。 */
-export declare function isValidCwd(cwd: unknown): cwd is string;
 /**
  * 词法归一:纯字符串运算,折 `.` / `..` / 重复分隔符,**不碰 fs**。
  * `posix.normalize` 把 `..` 在根部截断(`/../x` → `/x`),与「根之上没有东西」的语义一致;尾部分隔符

package/dist/task-cwd.js

@@ -1,14 +1,6 @@
 import path from "node:path";
+import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { executionLaneOf, handsOnWorkerFilePlane } from "./execution-lane-caps.js";
-export const MAX_CWD_CHARS = 4_096;
-export function isValidCwd(cwd) {
-    return (typeof cwd === "string" &&
-        cwd.length > 0 &&
-        cwd.length <= MAX_CWD_CHARS &&
-        !cwd.includes("\0") &&
-        path.isAbsolute(cwd) &&
-        !cwd.split(/[/\\]/).includes(".."));
-}
 export function normalizeAbsolutePathLexically(p) {
     const collapsed = path.posix.normalize(p.replace(/^\/+/, "/"));
     return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
@@ -55,7 +47,7 @@ export function parseAdditionalDirectories(raw) {
     for (const entry of raw) {
         if (out.length >= MAX_ADDITIONAL_DIRS)
             break;
-        if (!isValidCwd(entry) || seen.has(entry))
+        if (!isAbsoluteHostPath(entry) || seen.has(entry))
             continue;
         seen.add(entry);
         out.push(entry);

package/dist/tool-approval.d.ts

@@ -446,13 +446,11 @@ export interface ToolApprovalFrame {
      *    更需要知道「你看不到的那份里有隐形字符」,所以帽不影响本键;
      *  · 序列化失败(循环引用 / 抛错的 `toJSON` / BigInt)⇒ 两件事一起交白卷:args 不上帧,本键**不铸**
      *    (两次 `JSON.stringify` 共用同一个 try/catch —— 顶注反对的是第二个**静默降级点**,不是第二次序列化);
-     *  · 🔴 **7.70.0(S-103)改素材**:此前用的是脱敏后那份(理由=与卡面同源),而本版 `redactSecrets` 入口
-     *    先剥全部 `\p{Cf}` —— bidi 控制符**整族都是** `\p{Cf}` ⇒ 在脱敏后的文本上扫,本键恒缺席、E-14 整条
-     *    失效(六格红先复现)。所以判据素材改回原字节;同源那条理由让位于「信号必须真」。
-     *  · ⚠️ **上面「字节零改」那一条自 7.70.0 起对 `\p{Cf}` 族不再成立**:帧/卡上的 args 是**剥后**字节
-     *    (与 core 显示面 `renderUntrustedCommandText` 同律,显示的是真正执行的逻辑顺序),壳因此**拿不到
-     *    「在哪一位」**、只能按整只 args 打标。这是有意的取舍(夹层密钥的根治要求单一剥点),不是遗漏;
-     *    要恢复定位面需要给脱敏器一条 span/偏移表回填路(S-103 定案明确不做),不是在这条腿上加特判。
+     *  · 素材是**原字节**,不是脱敏后那份:7.70.0–7.124.x 的脱敏器吐出剥掉全部 `\p{Cf}` 的文本(bidi 控制符整族都是
+     *    `\p{Cf}`),在它上面扫本键恒缺席;7.125.0 起脱敏产物回到原文(认出的凭据跨度映回原文坐标替换,跨度外的
+     *    格式字符逐字保留),原字节与卡面在 bidi 控制符上已无差别,素材仍取原字节(脱敏前那一次序列化,上一条)。
+     *  · **「字节零改」对卡面 args 成立**:帧/卡上的 args 与预览是脱敏产物,方向控制符留在原位 —— 壳拿得到「在哪一位」,
+     *    显形 / 中和归壳的渲染面;只有被认出的凭据跨度(连同夹在其中的格式字符)整段换成记号。
      *
      * 判据**不看 `message`**(引擎/策略写的说明文本,不是待执行输入):本键被壳读作「**待执行的输入**可能
      * 在骗你的眼睛」,把两个来源折进一个布尔会让壳无法判断该给哪一段加显形标记。